Detecting and Mitigating Clear Command History (T1070.003)

Clear Command History (MITRE ATT&CK T1070.003) is a Stealth technique. MITRE lists ESXi, Linux, macOS, Network Devices and Windows as platforms.

Command interpreters remember what users type so that people can retrace their steps. An adversary who has used a compromised account may erase that record to hide what they did.

How attackers use it

MITRE explains what each platform keeps and how it can be wiped:

• Linux and macOS. While a user is logged in, history is tracked in the file pointed to by the HISTFILE environment variable. At logoff it is flushed to ~/.bash_history in the home directory. Adversaries may clear it by hand with history -c, or delete the file with rm ~/.bash_history.
• Network devices. Adversaries may use the device CLI with commands such as clear logging or clear history.
• ESXi. Command history may be removed from the /var/log/shell.log file.
• Windows PowerShell. There are two history providers. The built-in history only covers the current session and ends with it. The PSReadLine module tracks commands across all sessions and writes them to $env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default. Adversaries may run Clear-History to flush the current session, but MITRE notes this does not touch ConsoleHost_history.txt. They may also delete that file or edit it.

How to detect it

MITRE's analytics are one per platform:

• Linux: history -c, deletion or editing of ~/.bash_history, or changes to HISTFILE after login.
• macOS: history -c, or deleting or altering ~/.zsh_history or ~/.bash_history, with focus on sessions whose history is missing or wiped.
• Windows: Clear-History, or deletion of ConsoleHost_history.txt.
• ESXi: changes or truncation of /var/log/shell.log, especially soon after a login or configuration change.
• Network devices: use of clear history or clear logging commands.

Data you need: file deletion or modification events on history files, process command lines, and, for network devices, AAA command accounting. A user whose history file is suddenly empty or missing is a hint.

How to reduce the risk

MITRE lists three mitigations:

1. Remote data storage. Forward historical command line logs to a remote data store and centralized logging solution.
2. Restrict file and directory permissions. Stop users from deleting or writing to files such as ~/.bash_history or ConsoleHost_history.txt.
3. Environment variable permissions. Make the history-related environment variables read-only so history is preserved.

Check your own environment

# Linux or macOS: is your history file present, and when did it last change?
ls -l ~/.bash_history ~/.zsh_history 2>/dev/null
echo "$HISTFILE"

# Windows PowerShell: where is the PSReadLine history file? (read only)
(Get-PSReadLineOption).HistorySavePath

If your logging relies on these files, ask whether a copy also exists elsewhere.

Quick check

Sources

• MITRE ATT&CK T1070.003: Clear Command History